I'm not sure if you're aware of HTML Applications (.hta files), but they can be very dangerous as they have full access to the registry, hard drive, and anything else. All IE security features are completely disabled. The only tough part would be to get a user to open it. I'm not exactly sure...